Predictive disaster recovery system

ABSTRACT

Environmental data, associated with a first computer, is received. Social media data, associated with the first computer, is also received. A first severity value, based on the environmental data, is determined. A second severity value, based on the social media data, is determined. A first weighted severity score is determined. The first weighted severity score is a combination of the first and second severity values. One or more actions is determined. The determined action is one of a recovery point objective action or a recovery time objective action. Each action has a threshold. Whether the first weighted severity score is equal to or greater than any threshold associated with any action is determined. In response to determining that the first weighted severity score is equal to or greater than one or more thresholds, each action associated with each threshold is implemented.

BACKGROUND OF THE INVENTION

The present invention relates generally to the field of disasterrecovery, and more particularly to providing predictive disasterrecovery of cloud services.

Disaster recovery (DR) involves a set of policies and procedures toenable the recovery or continuation of vital technology infrastructureand systems following a natural disaster or man-made event. Disasterrecovery focuses on the information technology (IT) systems supportingcritical business functions, as opposed to business continuity, whichinvolves keeping all essential aspects of a business functioning despitesignificant disruptive events. Disaster recovery is therefore a subsetof business continuity. A business continuity plan (BCP) includesplanning for non-IT related aspects such as key personnel, facilities,crisis communication and reputation protection, and should refer to thedisaster recovery plan (DRP) for IT related infrastructurerecovery/continuity. IT disaster recovery control measures can beclassified into the following three types: preventive measures (controlsaimed at preventing an event from occurring), detective measures(controls aimed at detecting or discovering unwanted events), andcorrective measures (controls aimed at correcting or restoring thesystem after a disaster or an event). Good disaster recovery planmeasures dictate that these three types of controls be documented andexercised regularly. Two important measureable objectives in a disasterrecovery plan are the Recovery Time Objective (RTO) and the RecoveryPoint Objective (RPO). The RTO is the goal, measured in time, for howquickly an IT system is back online after a downtime event. The RPO isthe goal, also measured in time, for the point in time to which datamust be restored to resume services after a downtime event. RPO is oftenthought of as the time between the last data backup and the time adowntime event occurred.

Some of the current art utilizes advanced technology for disasterpredicting. For example, U.S. Pat. No. 7,035,765 B2, titled DisasterPredicting Method, Disaster Predicting Apparatus, Disaster PredictingProgram, and Computer-Readable Recording Medium Recorded with DisasterPredicting Program states the following: “A disaster predicting method,a disaster predicting apparatus, a disaster predicting program, and acomputer-readable recording medium recorded with a disaster predictingprogram, which automatically order satellite image data based onperiodically observed or predicted natural phenomenon, and alsoautomatically analyze the obtained satellite image data to predict adisaster, thereby enabling to deal promptly with a disaster.” Requiringthe use of satellite imagery may be a disadvantage for some datacenters.

SUMMARY

Embodiments of the present invention include a method for providingpredictive disaster recovery of cloud services. In one embodiment,environmental data, associated with a first computer, is received.Social media data, associated with the first computer, is also received.A first severity value, based on the environmental data, is determined.A second severity value, based on the social media data, is determined.A first weighted severity score is determined. The first weightedseverity score is a combination of the first and second severity values.One or more actions is determined. The determined action is one of arecovery point objective action or a recovery time objective action.Each action has a threshold. Whether the first weighted severity scoreis equal to or greater than any threshold associated with any action isdetermined. In response to determining that the first weighted severityscore is equal to or greater than one or more thresholds, each actionassociated with each threshold is implemented. An advantage of thismethod of providing predictive disaster recovery is the inclusion ofboth environmental and social media data.

In another aspect, a method for providing predictive disaster recoveryof cloud services includes studying the social media data. The methodsof studying the social media data include natural language processing,predictive analytics, cognitive analysis, object recognition, and videoanalytics. The second severity value is determined based on the studiedsocial media data. An advantage of this method is the several methods ofstudying the social media data which results in a thorough understandingof the social media data.

In yet another aspect, a computer program product includes programinstructions for providing predictive disaster recovery of cloudservices. The computer program product includes program instructions toreceive environmental data associated with a first computer. Thecomputer program product also includes program instructions to receivesocial media data associated with the first computer. The computerprogram product also includes program instructions to determine a firstseverity value based on the environmental data. The computer programproduct also includes program instructions to determine a secondseverity value based on the social media data. The computer programproduct also includes program instructions to determine a first weightedseverity score. The first weighted severity score is a combination ofthe first and second severity values. The computer program product alsoincludes program instructions to determine one or more actions. Thedetermined action is one of a recovery point objective action or arecovery time objective action. Each action has a threshold. Thecomputer program product also includes program instructions to determinewhether the first weighted severity score is equal to or greater thanany threshold associated with any action. In response to determiningthat the first weighted severity score is equal to or greater than oneor more thresholds, the computer program product also includes programinstructions to implement each action associated with each threshold. Anadvantage of this computer program product for providing predictivedisaster recovery is the inclusion of both environmental and socialmedia data.

In yet another aspect, a computer program product includes programinstructions for studying the social media data. The computer programproduct also includes program instructions to study the social mediadata. The methods of studying the social media data include naturallanguage processing, predictive analytics, cognitive analysis, objectrecognition, and video analytics. The computer program product alsoincludes program instructions to determine the second severity valuebased on the studied social media data. An advantage of this computerprogram product is the several methods of studying the social media datawhich results in a thorough understanding of the social media data.

In yet another aspect, a computer system includes program instructionsfor providing predictive disaster recovery of cloud services. Thecomputer system includes program instructions to receive environmentaldata associated with a first computer. The computer system also includesprogram instructions to receive social media data associated with thefirst computer. The computer system also includes program instructionsto determine a first severity value based on the environmental data. Thecomputer system also includes program instructions to determine a secondseverity value based on the social media data. The computer system alsoincludes program instructions to determine a first weighted severityscore. The first weighted severity score is a combination of the firstand second severity values. The computer system also includes programinstructions to determine one or more actions. The determined action isone of a recovery point objective action or a recovery time objectiveaction. Each action has a threshold. The computer system also includesprogram instructions to determine whether the first weighted severityscore is equal to or greater than any threshold associated with anyaction. In response to determining that the first weighted severityscore is equal to or greater than one or more thresholds, the computersystem also includes program instructions to implement each actionassociated with each threshold. An advantage of this computer programproduct for providing predictive disaster recovery is the inclusion ofboth environmental and social media data.

In yet another aspect, a computer system includes program instructionsfor studying the social media data. The computer system also includesprogram instructions to study the social media data. The methods ofstudying the social media data include natural language processing,predictive analytics, cognitive analysis, object recognition, and videoanalytics. The computer system also includes program instructions todetermine the second severity value based on the studied social mediadata. An advantage of this computer program product is the severalmethods of studying the social media data which results in a thoroughunderstanding of the social media data.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 depicts a cloud computing environment according to an embodimentof the present invention;

FIG. 2 depicts abstraction model layers according to an embodiment ofthe present invention;

FIG. 3 is a functional block diagram of a computing environment, inaccordance with an embodiment of the present invention;

FIG. 4 is a diagram depicting operational steps of a program thatfunctions to provide predictive disaster recovery of cloud services, inaccordance with an embodiment of the present invention;

FIG. 5 is an example table of weighted severity score threshold values,recovery point objective (RPO) actions, recovery time objective (RTO)actions and associated RPO/RTO costs, in accordance with an embodimentof the present invention; and

FIG. 6 depicts a block diagram of the components of the computingenvironment of FIG. 3, in accordance with an embodiment of the presentinvention.

DETAILED DESCRIPTION

Some embodiments of the present invention recognize that datacenterdowntime due to a natural disaster or man-made event may be expensive toboth a service provider and the various customers of the serviceprovider. For example, a credit card processing center is important toany number of retail businesses. If the credit card processing center isnot available for any length of time, businesses may lose sales or worsethan that, customers. In turn, the businesses may report the downtime tothe banks that issue various credit cards and those banks may turn toanother service provider for their credit card processing needs. Ascenario such as this may result in a financial impact to all partiesinvolved.

Embodiments of the present invention recognize that there may be amethod, computer program product, and computer system for providingpredictive disaster recovery of cloud services. The method, computerprogram product, and computer system may collect available environmentaldata (e.g., local weather data, severe weather data, etc.) as well asavailable social media data (e.g., text data, photo and/or video data,comments made to social media websites, etc.) and use the collected datato predict the likelihood of a datacenter interruption. Based on theprediction, preemptive action may be taken to reduce the chances of aninterruption.

It is to be understood that although this disclosure includes a detaileddescription on cloud computing, implementation of the teachings recitedherein are not limited to a cloud computing environment. Rather,embodiments of the present invention are capable of being implemented inconjunction with any other type of computing environment now known orlater developed.

Cloud computing is a model of service delivery for enabling convenient,on-demand network access to a shared pool of configurable computingresources (e.g., networks, network bandwidth, servers, processing,memory, storage, applications, virtual machines, and services) that canbe rapidly provisioned and released with minimal management effort orinteraction with a provider of the service. This cloud model may includeat least five characteristics, at least three service models, and atleast four deployment models.

Characteristics are as follows:

On-demand self-service: a cloud consumer can unilaterally provisioncomputing capabilities, such as server time and network storage, asneeded automatically without requiring human interaction with theservice's provider.

Broad network access: capabilities are available over a network andaccessed through standard mechanisms that promote use by heterogeneousthin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

Resource pooling: the provider's computing resources are pooled to servemultiple consumers using a multi-tenant model, with different physicaland virtual resources dynamically assigned and reassigned according todemand. There is a sense of location independence in that the consumergenerally has no control or knowledge over the exact location of theprovided resources but may be able to specify location at a higher levelof abstraction (e.g., country, state, or datacenter).

Rapid elasticity: capabilities can be rapidly and elasticallyprovisioned, in some cases automatically, to quickly scale out andrapidly released to quickly scale in. To the consumer, the capabilitiesavailable for provisioning often appear to be unlimited and can bepurchased in any quantity at any time.

Measured service: cloud systems automatically control and optimizeresource use by leveraging a metering capability at some level ofabstraction appropriate to the type of service (e.g., storage,processing, bandwidth, and active user accounts). Resource usage can bemonitored, controlled, and reported, providing transparency for both theprovider and consumer of the utilized service.

Service Models are as follows:

Software as a Service (SaaS): the capability provided to the consumer isto use the provider's applications running on a cloud infrastructure.The applications are accessible from various client devices through athin client interface such as a web browser (e.g., web-based e-mail).The consumer does not manage or control the underlying cloudinfrastructure including network, servers, operating systems, storage,or even individual application capabilities, with the possible exceptionof limited user-specific application configuration settings.

Platform as a Service (PaaS): the capability provided to the consumer isto deploy onto the cloud infrastructure consumer-created or acquiredapplications created using programming languages and tools supported bythe provider. The consumer does not manage or control the underlyingcloud infrastructure including networks, servers, operating systems, orstorage, but has control over the deployed applications and possiblyapplication hosting environment configurations.

Infrastructure as a Service (IaaS): the capability provided to theconsumer is to provision processing, storage, networks, and otherfundamental computing resources where the consumer is able to deploy andrun arbitrary software, which can include operating systems andapplications. The consumer does not manage or control the underlyingcloud infrastructure but has control over operating systems, storage,deployed applications, and possibly limited control of select networkingcomponents (e.g., host firewalls).

Deployment Models are as follows:

Private cloud: the cloud infrastructure is operated solely for anorganization. It may be managed by the organization or a third party andmay exist on-premises or off-premises.

Community cloud: the cloud infrastructure is shared by severalorganizations and supports a specific community that has shared concerns(e.g., mission, security requirements, policy, and complianceconsiderations). It may be managed by the organizations or a third partyand may exist on-premises or off-premises.

Public cloud: the cloud infrastructure is made available to the generalpublic or a large industry group and is owned by an organization sellingcloud services.

Hybrid cloud: the cloud infrastructure is a composition of two or moreclouds (private, community, or public) that remain unique entities butare bound together by standardized or proprietary technology thatenables data and application portability (e.g., cloud bursting forload-balancing between clouds).

A cloud computing environment is service oriented with a focus onstatelessness, low coupling, modularity, and semantic interoperability.At the heart of cloud computing is an infrastructure that includes anetwork of interconnected nodes.

Referring now to FIG. 1, illustrative cloud computing environment 50 isdepicted. As shown, cloud computing environment 50 includes one or morecloud computing nodes 10 with which local computing devices used bycloud consumers, such as, for example, personal digital assistant (PDA)or cellular telephone 54A, desktop computer 54B, laptop computer 54C,and/or automobile computer system 54N may communicate. Nodes 10 maycommunicate with one another. They may be grouped (not shown) physicallyor virtually, in one or more networks, such as Private, Community,Public, or Hybrid clouds as described hereinabove, or a combinationthereof. This allows cloud computing environment 50 to offerinfrastructure, platforms and/or software as services for which a cloudconsumer does not need to maintain resources on a local computingdevice. It is understood that the types of computing devices 54A-N shownin FIG. 1 are intended to be illustrative only and that computing nodes10 and cloud computing environment 50 can communicate with any type ofcomputerized device over any type of network and/or network addressableconnection (e.g., using a web browser).

Referring now to FIG. 2, a set of functional abstraction layers providedby cloud computing environment 50 (FIG. 1) is shown. It should beunderstood in advance that the components, layers, and functions shownin FIG. 2 are intended to be illustrative only and embodiments of theinvention are not limited thereto. As depicted, the following layers andcorresponding functions are provided:

Hardware and software layer 60 includes hardware and softwarecomponents. Examples of hardware components include: mainframes 61; RISC(Reduced Instruction Set Computer) architecture based servers 62;servers 63; blade servers 64; storage devices 65; and networks andnetworking components 66. In some embodiments, software componentsinclude network application server software 67 and database software 68.

Virtualization layer 70 provides an abstraction layer from which thefollowing examples of virtual entities may be provided: virtual servers71; virtual storage 72; virtual networks 73, including virtual privatenetworks; virtual applications and operating systems 74; and virtualclients 75.

In one example, management layer 80 may provide the functions describedbelow. Resource provisioning 81 provides dynamic procurement ofcomputing resources and other resources that are utilized to performtasks within the cloud computing environment. Metering and Pricing 82provide cost tracking as resources are utilized within the cloudcomputing environment, and billing or invoicing for consumption of theseresources. In one example, these resources may include applicationsoftware licenses. Security provides identity verification for cloudconsumers and tasks, as well as protection for data and other resources.User portal 83 provides access to the cloud computing environment forconsumers and system administrators. Service level management 84provides cloud computing resource allocation and management such thatrequired service levels are met. Service Level Agreement (SLA) planningand fulfillment 85 provide pre-arrangement for, and procurement of,cloud computing resources for which a future requirement is anticipatedin accordance with an SLA.

Workloads layer 90 provides examples of functionality for which thecloud computing environment may be utilized. Examples of workloads andfunctions which may be provided from this layer include: mapping andnavigation 91; software development and lifecycle management 92; virtualclassroom education delivery 93; data analytics processing 94;transaction processing 95; and prediction orchestrator 96.

FIG. 3 is a functional block diagram of a computing environment,generally designated 300, in accordance with an embodiment of thepresent invention. FIG. 3 provides only an illustration of oneimplementation and does not imply any limitations with regard to theenvironments in which different embodiments may be implemented. Thoseskilled in the art may make many modifications to the depictedenvironment without departing from the scope of the invention as recitedby the claims.

An embodiment of computing environment 300 includes backup server 320and local server 330. Local server 330 includes database repository 332and prediction program 334. Backup server 320 and local server 330 areinterconnected via network 310. In example embodiments, computingenvironment 300 may include other computing devices not shown such assmartwatches, cell phones, smartphones, phablets, tablet computers,laptop computers, desktop computers, other computer servers or any othercomputer system known in the art, interconnected with backup server 320and local server 330 over network 310.

In example embodiments, backup server 320 and local server 330 mayconnect to network 310 which enables backup server 320 and local server330 to access any other computing devices and/or data not directlystored on backup server 320 or local server 330. Network 310 may be alocal area network (LAN), a telecommunications network, a wide areanetwork (WAN) such as the Internet, or any combination of the three, andinclude wired, wireless or fiber optic connections. Network 310 mayinclude one or more wired and/or wireless networks that are capable ofreceiving and transmitting data, voice, and/or video signals, includingmultimedia signals that include voice, data, and video information. Ingeneral, network 310 may be any combination of connections and protocolsthat will support communications between backup server 320, local server330, and other computing devices (not shown) within computingenvironment 300, in accordance with embodiments of the presentinvention.

In embodiments of the present invention, backup server 320 may be alaptop, tablet, or netbook personal computer (PC), a desktop computer, apersonal digital assistant (PDA), a smartphone, or any other hand-held,programmable electronic device capable of communicating with localserver 330 or any other computing device within computing environment300. In certain embodiments, backup server 320 represents a computersystem utilizing clustered computers and components (e.g., databaseserver computers, application server computers, etc.) that act as asingle pool of seamless resources when accessed by elements of computingenvironment 300. In general, backup server 320 is representative of anyelectronic device or combination of electronic devices capable ofexecuting computer readable program instructions. In an embodiment,backup server 320 may serve as a backup server to local server 330 asneeded (e.g., local server 330 is not operating correctly, local server330 is removed from service for preventative maintenance, etc.).Computing environment 300 may include any number of backup server 320.Backup server 320 may include components as depicted and described indetail with respect to cloud computing node 10 in cloud computingenvironment 50, as described in reference to FIG. 1, in accordance withembodiments of the present invention. Backup server 320 may also includecomponents as depicted and described in further detail with respect toFIG. 6, in accordance with embodiments of the present invention.

In an embodiment, local server 330 may be a laptop, tablet, or netbookpersonal computer (PC), a desktop computer, a personal digital assistant(PDA), a smartphone, or any other hand-held, programmable electronicdevice capable of communicating with backup server 320 or any othercomputing device within computing environment 300. In certainembodiments, local server 330 represents a computer system utilizingclustered computers and components (e.g., database server computers,application server computers, etc.) that act as a single pool ofseamless resources when accessed by elements of computing environment300. In general, local server 330 is representative of any electronicdevice or combination of electronic devices capable of executingcomputer readable program instructions. In an embodiment, local server330 may require the services of backup server 320 (e.g., if local server330 is not operating correctly, if local server 330 is removed fromservice for preventative maintenance, etc.). Computing environment 300may include any number of local server 330. Local server 330 may includecomponents as depicted and described in detail with respect to cloudcomputing node 10 in cloud computing environment 50, as described inreference to FIG. 1, in accordance with embodiments of the presentinvention. Local server 330 may include components as depicted anddescribed in further detail with respect to FIG. 6, in accordance withembodiments of the present invention.

In an embodiment, database repository 332 may be storage that may bewritten to and/or read by backup server 320 and local server 330. In oneembodiment, database repository 332 resides on local server 330. Inother embodiments, database repository 332 may reside on backup server320 or any other device (not shown) in computing environment 300, incloud storage or on another computing device accessible via network 310.In yet another embodiment, database repository 332 may representmultiple storage devices within local server 330. Database repository332 may be implemented using any volatile or non-volatile storage mediafor storing information, as known in the art. For example, databaserepository 332 may be implemented with a tape library, optical library,one or more independent hard disk drives, multiple hard disk drives in aredundant array of independent disks (RAID), solid-state drives (SSD),or random-access memory (RAM). Similarly, database repository 332 may beimplemented with any suitable storage architecture known in the art,such as a relational database, an object-oriented database, or one ormore tables.

According to embodiments of the present invention, database repository332 may store a table of recovery point objective (RPO) actions andassociated costs for a range of weighted severity score thresholdvalues. In a like manner, database repository may store a table of(recovery time objective (RTO) actions and associated costs for a rangeof weighted severity score threshold values. In an embodiment, the RPOtable and the RTO table are determined by a user, based on the locationof the datacenter and the history of natural disasters and man-madeevents for that location, and stored to database repository 332. Invarious embodiments of the present invention, a natural disaster may bean event that affects the operations of a datacenter (e.g., a hurricane,a tornado, a flood, an earthquake, etc.) or an event which may turn intoa situation that affects the operations of a datacenter (e.g., athunderstorm, a tropical storm, etc.) In an embodiment, a man-made eventis an event caused by humans which may affect the operations of adatacenter. In an embodiment, the RPO table and the RTO table may becombined into a single table as shown in the FIG. 5 example.

In an embodiment of the present invention, prediction program 334 maystore data to database repository 332. In another embodiment, otherapplications (not shown) operating on local server 330 may store data todatabase repository 332. In yet another embodiment, the RTO and RPOactions for a datacenter may be stored to database repository 332. Inyet another embodiment, social media data and environmental data may bestored to database repository 332. Examples of social media data storedto database repository 332 include short comments from microblog socialnetworks, short message service (SMS) and multimedia messaging service(MMS) texts, content from social networking websites, content fromlocal, regional, and, national news feeds, content from photo and videosharing websites, and the like. Examples of environmental data stored todatabase repository 332 include data from local, regional, and nationalnews and weather services, data from weather sensors operated by thelocal server 330 owner, data from public weather sensors (e.g., a homeweather station connected to the Internet via the Internet of Things),data from other sensors (e.g., seismic sensors, tsunami detectors,etc.), and the like.

In an embodiment, environmental data and social media data may beanalyzed using Natural Language Processing (NLP), predictive analytics,cognitive computing, object recognition, video content analytics and thelike. In an embodiment, NLP is a field of computer science, artificialintelligence, and computational linguistics concerned with theinteractions between computers and human (natural) languages. As such,NLP is related to the area of human-computer interaction. Manychallenges in NLP involve natural language understanding, that is,enabling computers to derive meaning from human or natural languageinput, and others involve natural language generation.

In an embodiment, predictive analytics encompasses a variety ofstatistical techniques from predictive modeling, machine learning, anddata mining that analyze current and historical facts to makepredictions about future or otherwise unknown events. In business,predictive models exploit patterns found in historical and transactionaldata to identify risks and opportunities. Models capture relationshipsamong many factors to allow assessment of risk or potential associatedwith a particular set of conditions, guiding decision making forcandidate transactions.

In an embodiment, cognitive computing involves self-learning systemsthat use data mining, pattern recognition and natural languageprocessing to mimic the way the human brain works. The goal of cognitivecomputing is to create automated IT systems that are capable of solvingproblems without requiring human assistance. Cognitive computing systemsuse machine learning algorithms. Such systems continually acquireknowledge from the data fed into them by mining data for information.The systems refine the way they look for patterns and as well as the waythey process data so they become capable of anticipating new problemsand modeling possible solutions.

In an embodiment, object recognition, in the field of computer vision,describes the task of finding and identifying objects in an image orvideo sequence. Humans recognize a multitude of objects in images withlittle effort, despite the fact that the image of the objects may varysomewhat in different viewpoints, in many different sizes and scales, oreven when they are translated or rotated. Objects may even be recognizedwhen they are partially obstructed from view. Methods used may beappearance-based or feature-based.

In an embodiment, video content analytics (VCA) is the capability ofautomatically analyzing video to detect and determine temporal andspatial events. This technical capability is used in a wide range ofdomains including entertainment, health-care, retail, automotive,transport, home automation, safety and security. The algorithms can beimplemented as software on general purpose machines, or as hardware inspecialized video processing units. Many different functionalities canbe implemented in VCA. Video Motion Detection is one of the simplerforms where motion is detected with regard to a fixed background scene.More advanced functionalities include video tracking and egomotionestimation. Based on the internal representation that VCA generates inthe machine, it is possible to build other functionalities, such asidentification, behavior analysis or other forms of situation awareness.VCA relies on good input video, so it is often combined with videoenhancement technologies such as video denoising, image stabilization,unsharp masking and super-resolution.

According to embodiments of the present invention, prediction program334 may be a program, subprogram of a larger program, application,plurality of applications, or mobile application software whichfunctions to provide predictive disaster recovery of cloud services. Aprogram is a sequence of instructions written by a programmer to performa specific task. Prediction program 334 may run by itself but may bedependent on system software (not shown) to execute. In one embodiment,prediction program 334 functions as a stand-alone program residing onlocal server 330. In another embodiment, prediction program 334 may beincluded as a part of an operating system (not shown) of local server330. In yet another embodiment prediction program 334 may work inconjunction with other programs, applications, etc., found on localserver 330 or in computing environment 300. In yet another embodiment,prediction program 334 may be found on backup server 320 or othercomputing devices (not shown) in computing environment 300 which areinterconnected to local server 330 via network 310. Prediction program334 may be substantially similar to prediction orchestrator 96 in cloudcomputing environment 50.

According to embodiments of the present invention, prediction program334 functions to provide predictive disaster recovery of cloud services.According to an embodiment of the present invention, prediction program334 utilizes the social media data and the environmental data stored todatabase repository 332 to determine a weighted severity score (WSS)which is used to trigger actions to prevent downtime and loss of data oflocal server 330.

FIG. 4 is a diagram of flowchart 400 representing operational steps forproviding predictive disaster recovery of cloud services, in accordancewith an embodiment of the present invention. In one embodiment,prediction program 334 performs the operational steps of flowchart 400.In an alternative embodiment, any other program, while working withprediction program 334, may perform the operational steps of flowchart400. In an embodiment, prediction program 334 may invoke the operationalsteps of flowchart 400 upon the request of a user. In an alternativeembodiment, prediction program 334 may invoke the operational steps offlowchart 400 automatically upon the receipt of environmental data orsocial media data.

In an embodiment, prediction program 334 receives environmental data(step 402). In other words, prediction program 334 receivesenvironmental data concerning the weather and potential events which mayimpact the capability of a datacenter (e.g., local server 330) toperform services. In an embodiment, the environmental data is receivedupon the request of a user. In another embodiment, the environmentaldata is received on a periodic time basis (e.g., every fifteen minutes,every hour, every four hours, or any periodic time basis defined by auser). In yet another embodiment, the environmental data is receivedwhenever environmental data is made available by an environmental datasource (e.g., a weather service or a news organization). In anembodiment, the data received may include data from local, regional, andnational news and weather services, data from private weather sensorsowned by the operator of local server 330, data from public weathersensors (e.g., a home weather station connected to the Internet via theInternet of Things), data from other sensors (e.g., seismic sensors,tsunami detectors, etc.), and the like, which may affect the operationof the datacenter. In an embodiment, prediction program 334 receives adaily weather report and any active weather watches and/or warnings andthe data received is stored to database repository 332 in local server330.

In a first example, a credit card processing datacenter receives thelocal weather report which indicates thunderstorms in the area where thecredit card processing datacenter is located. Also received by thecredit card processing datacenter is a tornado warning for the areawhere the credit card processing datacenter is located. In a secondexample, the credit card processing datacenter receives the localweather report which indicates thunderstorms but with a tornado watchrather than a tornado warning in effect in the area where the creditcard processing datacenter is located. In a third example, the creditcard processing datacenter receives the local weather report whichindicates heavy rain for the day with hail storms possible in the areawhere the credit card processing datacenter is located.

In an embodiment, prediction program 334 receives social data (step404). In other words, prediction program 334 receives social media dataincluding short comments from microblog social networks, short messageservice (SMS) and multimedia messaging service (MMS) texts, content fromsocial networking websites, content from local, regional, and, nationalnews services, content from photo and video sharing websites, and thelike, which may include information concerning situations that mayaffect the operation of a datacenter (e.g., local server 330). In anembodiment, the social media data is received upon the request of auser. In another embodiment, the social media data is received on aperiodic time basis (e.g., every fifteen minutes, every hour, every fourhours, or any periodic time basis defined by a user). In yet anotherembodiment, the social media data is received whenever social media datais posted, by a user, to a social media website. In an embodiment, thesocial media data is studied in order to glean specific data which mayaffect the capability of a datacenter from the global social media data.Methods of study may include NLP, predictive analytics, cognitiveanalysis, object recognition, video analytics, and the like. In anembodiment, prediction program 334 receives a summary of local newsfeeds as well as a summary of social media comments made by a pluralityof users and the data received is stored to database repository 332 inlocal server 330.

In a first example, a credit card processing datacenter receives asummary of social media commentary which indicates that several peoplehave observed lightning five miles from the credit card processingdatacenter along with a funnel cloud in the area where the credit cardprocessing datacenter is located. In a second example, the credit cardprocessing datacenter receives social media commentary aboutthunderstorms but there is no mention of a funnel cloud in the areawhere the credit card processing datacenter is located. In a thirdexample, social media commentary received by the credit card processingdatacenter indicates that area residents are complaining about possiblehail damage to their automobiles.

In an embodiment, prediction program 334 determines severity values(step 406). In other words, prediction program 334 determines a firstseverity value (SV), based on the received environmental data (step 402)and also determines a second severity value (SV), based on the receivedsocial media data (step 404). In an embodiment, the first and second SVis determined by a user. In another embodiment, the first and second SVis determined by prediction program 334 via an algorithm such as theMaximum Likelihood Estimate (MLE), the least absolute shrinkage andselection operator (LASSO), the ElasticNet (EN) and the like. In anembodiment, MLE is a method of estimating the parameters of astatistical model given data. In an embodiment, LASSO is a regressionanalysis method that performs both variable selection and regularizationin order to enhance the prediction accuracy and interpretability of thestatistical model it produces. In an embodiment, EN, in the fitting oflinear or logistic regression models, is a regularized regression methodthat linearly combines penalties of the lasso method. In an embodiment,an SV, based on a scale of one to ten, is an indicator of how accurate,disruptive, and imminent the received environmental data and thereceived social media data may be to the capability of the datacenter toperform services contracted by a user of the datacenter. For example,consider a scenario where a large grass fire is near a rural datacenter.Local and state agencies (e.g., the Department of Natural Resources orthe Department of Environmental Conservation) will monitor the grassfire and issue updates. The agencies may also use information fromvarious weather services to monitor conditions that may affect the grassfire such as current wind speed and the outlook for precipitation. Inthis example, a grass fire ten miles from the datacenter with radarindicating heavy rain within the next thirty minutes over area where thegrass fire is located may have an environmental data SV of four.However, if the grass fire were only three miles from the datacenter andprevailing winds were from the area of the grass fire towards thedatacenter, the environmental data SV may be nine. According toembodiments of the present invention, a low severity value indicatesthat a problem is unlikely while a high severity value indicates aproblem is likely. In an embodiment, prediction program 334 determinestwo severity values, a first based on the environmental data stored todatabase repository 332 on local server 330 and a second based on thesocial media data stored to database repository 332 on local server 330.

In a first example, an environmental SV of eight is assigned based onthe environmental data of possible thunderstorms and the tornado warningnear the location of the credit card processing datacenter while asocial media SV of ten is assigned based on the social media data oflightning in the area and a sighting of a funnel cloud. In a secondexample, an environmental SV of seven is assigned based on theenvironmental data of possible thunderstorms and a tornado watch ineffect for the location near the credit card processing datacenter whilea social media SV of five is assigned based on observations of lightningonly in the area of the credit card processing datacenter. In a thirdexample, an environmental SV of three is assigned based on theenvironmental data of heavy rain for the day with the possibility ofhail storms while a social media SV of three is assigned based on socialmedia data indicating area residents are expressing concern overpossible hail damage to automobiles.

In an embodiment, prediction program 334 determines the weightedseverity score (step 408). In other words, prediction program 334determines the weighted severity score (WSS) based on the determinedenvironmental data severity value and the determined social media dataseverity value (step 406). In an embodiment, the determinedenvironmental data SV and the determined social media data SV are addedtogether to determine the WSS. In another embodiment, the determinedenvironmental data SV and the determined social media data SV areaveraged on a periodic time basis (e.g., every fifteen minutes, everyhour, etc.) and then the two average SV scores are added to determinethe WSS. In yet another embodiment, the WSS is determined based on aweighting of the determined environmental data SV and a weighting of thedetermined social media data SV. In yet another embodiment, thedetermined environmental data SV and the determined social media data SVare multiplied to yield a determined WSS between zero and one-hundred.In an embodiment, the WSS is an overall severity score for the currentnatural disaster or man-made event gleaned from the environmental dataand the social media data.

In a first example, a WSS of eighteen is determined based on the SV ofeight for the environmental data and the SV of ten for the social mediadata. In a second example, a WSS of twelve is determined based on the SVof seven for the environmental data and the SV of five for the socialmedia data. In a third example, a WSS of six is determined based on theSV of three for the environmental data and the SV of three for thesocial media data.

In another example using weighting, the environmental data SV ismultiplied by a factor of one hundred and twenty-five percent due to theenvironmental data being based on factual data while the social mediadata SV is multiplied by a factor of fifty percent due to the socialmedia data being anecdotal (i.e., based on personal observation ratherthan scientific evaluation). For the example where the environmentaldata SV is eight and the social media data SV is ten, the weightingresults in a determined WSS of fifteen (rounded to the nearest wholenumber) versus the previously determined WSS of eighteen using simpleaddition.

In an embodiment, prediction program 334 determines actions (step 410).In other words, prediction program 334 determines what RPO/RTO actionsare appropriate for the determined WSS (step 408). In an embodiment,prediction program 334 refers to the applicable table stored to databaserepository 332 in local server 330, an example of which is shown in FIG.5.

In an embodiment, prediction program 334 determines whether thedetermined WSS is equal to or greater than a threshold (decision step412). In other words, prediction program 334 uses the determined WSS(step 408) and determines whether that determined WSS is equal to orgreater than a threshold WSS value. In an embodiment, a threshold WSSvalue is a particular value of the WSS at which a specific RPO and/orRTO action is implemented. In an embodiment, there may be a single RPOand/or RTO threshold value (e.g., at a WSS equal to or greater thanseven, take an RPO and/or RTO action). In another embodiment, there maybe any number of RPO and/or RTO threshold values (e.g., at a WSS offive, take RPO action ‘A’, at a WSS of seven, take RTO action ‘B’,etc.). In an embodiment (decision step 412, NO branch), predictionprogram 334 determines that a WSS threshold value has not been met orexceeded; therefore, prediction program 334 proceeds to step 402 tocontinue receiving environmental data and social media data. In theembodiment (decision step 412, YES branch), prediction program 334determines that a WSS threshold value has been met or exceeded;therefore, prediction program 334 proceeds to step 414.

In an embodiment, the threshold WSS value(s) may be determined by auser. In another embodiment, the threshold WSS value(s) may bedetermined by historical natural and man-made events along with theresults of actions taken by a datacenter to mitigate those natural andman-made events. In yet another embodiment, the WSS threshold value(s)may be adjusted based on the relative importance of the data maintainedby the datacenter. For example, a datacenter maintaining a history ofsports records may have a high WSS threshold value for a given action(e.g., perform full data replication at a WSS threshold value oftwenty). If the datacenter gains another customer that needs socialsecurity number and credit card number data maintained, the WSSthreshold value may be lowered for that given action (e.g., perform fulldata replication at a WSS threshold value of ten) so that action may betaken sooner due to the higher importance of social security number dataand credit card number data over the sports records.

In an embodiment, prediction program 334 implements an action (step414). In other words, based on the determination that a WSS thresholdvalue has been met or exceeded (decision step 412, YES branch),prediction program 334 implements an RPO and/or RTO action(s). Accordingto an embodiment of the present invention, the RPO/RTO action(s) may beimplemented automatically by prediction program 334. In anotherembodiment, the RPO/RTO action(s) may be implemented by a user. In anembodiment, an RPO action for a low WSS may be to monitor the weather orman-made situation (e.g., a civil protest). In another embodiment, anRPO action for a high WSS may be to create database backups or toperform data replication from the affected datacenter to a backupdatacenter in a different geographic location. In an embodiment, in thecase of a datacenter-to-datacenter replication, the affected datacenterwould query the WSS for the nearby potential backup datacenters capableof handling the replication to determine the potential backup datacenterwith the lowest WSS. In an embodiment, the determined WSS value mayincrease slowly with time (e.g., as severe weather is slowly moving intoan area) resulting in multiple RPO/RTO actions being implemented atvarious WSS threshold values. In another embodiment, the determined WSSmay increase rapidly (e.g., from a value of zero immediately to a valueof twenty as in the case of a sudden earthquake) resulting in theimplementation of only the RPO/RTO actions associated with the WSS valueof twenty. In yet another embodiment, prediction program 334 may usehistorical disaster recovery events in order to improve the accuracy ofthe SV determination and therefore, the WSS threshold values andassociated RPO/RTO actions. In an embodiment, prediction program 334implements an RPO action to replicate the data stored to databaserepository 332 on local server 330 to backup server 320.

Please refer to FIG. 5 for the following examples. In a first example,the credit card processing datacenter implements an RPO action toreplicate the credit card database to a backup datacenter located thirtymiles away based on the current determined WSS of eighteen meeting orexceeding the WSS threshold value of eighteen. The selected backupdatacenter has a current WSS of four. The backup datacenter was selectedbecause the WSS of four was lower than all other available backupdatacenters. Also, based on the determined WSS of eighteen, thedatacenter implements an RTO action to bring new IT equipment online. Ina second example, based on the current determined WSS of twelve meetingor exceeding the WSS threshold value of twelve, the credit cardprocessing datacenter implements an RTO action to notify potentialbackup datacenters that a datacenter replication may be required andimplements an RTO action to check available backup equipment both on andoff site. In a third example, based on the current determined WSS of sixmeeting or exceeding the WSS threshold value of six, the credit cardprocessing datacenter implements an RPO action to run local backups ofthe data stored by the datacenter. As shown in FIG. 5, at the WSSthreshold value of six, there is no RTO action to implement but the RTOaction for a WSS threshold value of three would likely have already beenimplemented. As also shown in FIG. 5, a WSS threshold value may have noassociated RPO/RTO actions.

In another embodiment, the RPO/RTO action may be implemented manually bya user monitoring environmental data, social media data, and historicaldisaster recovery data via an analytics dashboard. For example, adetermined WSS may be sent to a user at a remote location (i.e., not atthe datacenter location for which the WSS was determined). The user mayreview past event history for the datacenter location for which the WSSwas determined, check current environmental data and social media datarelated to that particular datacenter, and decide to take a specificRPO/RTO action.

In another embodiment, prediction program 334 may be used to determinewhen, after a natural disaster or man-made event, it is time to returnto the normal state of operation (e.g., return to the originaldatacenter from the backup datacenter). In an embodiment, additionalenvironmental data and additional social media data are received. Athird severity value, based on the additional environmental data, isdetermined. A fourth severity value, based on the additional socialmedia data, is determined. A combination of the third severity value andthe fourth severity value yields a second weighted severity score.Additional RPO and additional RTO actions are determined. Eachadditional RPO/RTO action has a threshold. Additional RPO/RTO actionsare implemented when the second weighted severity score is equal to orgreater than any of the thresholds. For example, after a tornado warningand tornado watch have both expired, the determined WSS will drop from ahigh value to a lower value (assuming no other events are causing anincrease in the determined WSS). As the determined WSS drops over time,RPO and RTO actions may be implemented to transfer responsibility fromthe backup datacenter to the original datacenter where operations weredisrupted by the tornado warning and tornado watch.

FIG. 6 depicts computer system 600 which is an example of a system thatincludes prediction program 334. Computer system 600 may be an exampleof the backup server 320 or the local server 330 of FIG. 3. Computersystem 600 includes processors 601, cache 603, memory 602, persistentstorage 605, communications unit 607, input/output (I/O) interface(s)606, and communications fabric 604. Communications fabric 604 providescommunications between cache 603, memory 602, persistent storage 605,communications unit 607, and input/output (I/O) interface(s) 606.Communications fabric 604 can be implemented with any architecturedesigned for passing data and/or control information between processors(such as microprocessors, communications and network processors, etc.),system memory, peripheral devices, and any other hardware componentswithin a system. For example, communications fabric 604 can beimplemented with one or more buses or a crossbar switch.

Memory 602 and persistent storage 605 are computer readable storagemedia. In this embodiment, memory 602 includes random access memory(RAM). In general, memory 602 can include any suitable volatile ornon-volatile computer readable storage media. Cache 603 is a fast memorythat enhances the performance of processors 601 by holding recentlyaccessed data, and data near recently accessed data, from memory 602.

Program instructions and data used to practice embodiments of thepresent invention may be stored in persistent storage 605 and in memory602 for execution by one or more of the respective processors 601 viacache 603. In an embodiment, persistent storage 605 includes a magnetichard disk drive. Alternatively, or in addition to a magnetic hard diskdrive, persistent storage 605 can include a solid state hard drive, asemiconductor storage device, read-only memory (ROM), erasableprogrammable read-only memory (EPROM), flash memory, or any othercomputer readable storage media that is capable of storing programinstructions or digital information.

The media used by persistent storage 605 may also be removable. Forexample, a removable hard drive may be used for persistent storage 605.Other examples include optical and magnetic disks, thumb drives, andsmart cards that are inserted into a drive for transfer onto anothercomputer readable storage medium that is also part of persistent storage605.

Communications unit 607, in these examples, provides for communicationswith other data processing systems or devices. In these examples,communications unit 607 includes one or more network interface cards.Communications unit 607 may provide communications through the use ofeither or both physical and wireless communications links. Programinstructions and data used to practice embodiments of the presentinvention may be downloaded to persistent storage 605 throughcommunications unit 607.

I/O interface(s) 606 allows for input and output of data with otherdevices that may be connected to each computer system. For example, I/Ointerface 606 may provide a connection to external devices 608 such as akeyboard, keypad, a touch screen, and/or some other suitable inputdevice. External devices 608 can also include portable computer readablestorage media such as, for example, thumb drives, portable optical ormagnetic disks, and memory cards. Software and data used to practiceembodiments of the present invention can be stored on such portablecomputer readable storage media and can be loaded onto persistentstorage 605 via I/O interface(s) 606. I/O interface(s) 606 also connectto display 609.

Display 609 provides a mechanism to display data to a user and may be,for example, a computer monitor.

The present invention may be a system, a method, and/or a computerprogram product. The computer program product may include a computerreadable storage medium (or media) having computer readable programinstructions thereon for causing a processor to carry out aspects of thepresent invention.

The computer readable storage medium can be a tangible device that canretain and store instructions for use by an instruction executiondevice. The computer readable storage medium can be, for example, but isnot limited to, an electronic storage device, a magnetic storage device,an optical storage device, an electromagnetic storage device, asemiconductor storage device, or any suitable combination of theforegoing. A non-exhaustive list of more specific examples of thecomputer readable storage medium includes the following: a portablecomputer diskette, a hard disk, a random access memory (RAM), aread-only memory (ROM), an erasable programmable read-only memory (EPROMor Flash memory), a static random access memory (SRAM), a portablecompact disc read-only memory (CD-ROM), a digital versatile disk (DVD),a memory stick, a floppy disk, a mechanically encoded device such aspunch-cards or raised structures in a groove having instructionsrecorded thereon, and any suitable combination of the foregoing. Acomputer readable storage medium, as used herein, is not to be construedas being transitory signals per se, such as radio waves or other freelypropagating electromagnetic waves, electromagnetic waves propagatingthrough a waveguide or other transmission media (e.g., light pulsespassing through a fiber-optic cable), or electrical signals transmittedthrough a wire.

Computer readable program instructions described herein can bedownloaded to respective computing/processing devices from a computerreadable storage medium or to an external computer or external storagedevice via a network, for example, the Internet, a local area network, awide area network and/or a wireless network. The network may comprisecopper transmission cables, optical transmission fibers, wirelesstransmission, routers, firewalls, switches, gateway computers and/oredge servers. A network adapter card or network interface in eachcomputing/processing device receives computer readable programinstructions from the network and forwards the computer readable programinstructions for storage in a computer readable storage medium withinthe respective computing/processing device.

Computer readable program instructions for carrying out operations ofthe present invention may be assembler instructions,instruction-set-architecture (ISA) instructions, machine instructions,machine dependent instructions, microcode, firmware instructions,state-setting data, or either source code or object code written in anycombination of one or more programming languages, including an objectoriented programming language such as Smalltalk, C++ or the like, andconventional procedural programming languages, such as the “C”programming language or similar programming languages. The computerreadable program instructions may execute entirely on the user'scomputer, partly on the user's computer, as a stand-alone softwarepackage, partly on the user's computer and partly on a remote computeror entirely on the remote computer or server. In the latter scenario,the remote computer may be connected to the user's computer through anytype of network, including a local area network (LAN) or a wide areanetwork (WAN), or the connection may be made to an external computer(for example, through the Internet using an Internet Service Provider).In some embodiments, electronic circuitry including, for example,programmable logic circuitry, field-programmable gate arrays (FPGA), orprogrammable logic arrays (PLA) may execute the computer readableprogram instructions by utilizing state information of the computerreadable program instructions to personalize the electronic circuitry,in order to perform aspects of the present invention.

Aspects of the present invention are described herein with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems), and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer readable program instructions.

These computer readable program instructions may be provided to aprocessor of a general purpose computer, special purpose computer, orother programmable data processing apparatus to produce a machine, suchthat the instructions, which execute via the processor of the computeror other programmable data processing apparatus, create means forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks. These computer readable program instructionsmay also be stored in a computer readable storage medium that can directa computer, a programmable data processing apparatus, and/or otherdevices to function in a particular manner, such that the computerreadable storage medium having instructions stored therein comprises anarticle of manufacture including instructions which implement aspects ofthe function/act specified in the flowchart and/or block diagram blockor blocks.

The computer readable program instructions may also be loaded onto acomputer, other programmable data processing apparatus, or other deviceto cause a series of operational steps to be performed on the computer,other programmable apparatus or other device to produce a computerimplemented process, such that the instructions which execute on thecomputer, other programmable apparatus, or other device implement thefunctions/acts specified in the flowchart and/or block diagram block orblocks.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods, and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof instructions, which comprises one or more executable instructions forimplementing the specified logical function(s). In some alternativeimplementations, the functions noted in the block may occur out of theorder noted in the figures. For example, two blocks shown in successionmay, in fact, be executed substantially concurrently, or the blocks maysometimes be executed in the reverse order, depending upon thefunctionality involved. It will also be noted that each block of theblock diagrams and/or flowchart illustration, and combinations of blocksin the block diagrams and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts or carry out combinations of special purpose hardwareand computer instructions.

The descriptions of the various embodiments of the present inventionhave been presented for purposes of illustration, but are not intendedto be exhaustive or limited to the embodiments disclosed. Manymodifications and variations will be apparent to those of ordinary skillin the art without departing from the scope and spirit of the invention.The terminology used herein was chosen to best explain the principles ofthe embodiment, the practical application or technical improvement overtechnologies found in the marketplace, or to enable others of ordinaryskill in the art to understand the embodiments disclosed herein.

What is claimed is:
 1. A method for providing predictive disasterrecovery of cloud services, the method comprising: receiving, by one ormore computer processors, environmental data associated with a firstcomputer; receiving, by one or more computer processors, social mediadata associated with the first computer; determining, by one or morecomputer processors, a first severity value based on the environmentaldata; determining, by one or more computer processors, a second severityvalue based on the social media data; determining, by one or morecomputer processors, a first weighted severity score, wherein the firstweighted severity score is a combination of the first severity value andthe second severity value; determining, by one or more computers, one ormore actions, wherein each action of the one or more actions is selectedfrom the group consisting of a recovery point objective action and arecovery time objective action, and wherein each action of the one ormore actions has a threshold; determining, by one or more computerprocessors, whether the determined first weighted severity score isequal to or greater than any threshold associated with any actions ofthe one or more actions; and responsive to determining that thedetermined first weighted severity score is equal to or greater than oneor more thresholds, implementing, by one or more computer processors,the one or more actions associated with the one or more thresholds. 2.The method of claim 1, wherein the combination of the first severityvalue and the second severity value is selected from the groupconsisting of adding the first severity value and the second severityvalue together, averaging the first severity value over a first periodictime basis, averaging the second severity value over a second periodictime basis, and adding the average first severity value and the averagesecond severity value together, weighting the first severity value,weighting the second severity value, and adding the weighted firstseverity value and the weighted second severity value together, andmultiplying the first severity value by the second severity value. 3.The method of claim 1, wherein the environmental data is selected fromthe group consisting of a news service, a weather service, and a weathersensor.
 4. The method of claim 1, wherein the social media data includesdata is selected from the group consisting of a short message servicetext, a multimedia messaging service text, a content from a newsservice, a content from a social networking website, and a content froma photo/video sharing website.
 5. The method of claim 1, wherein thefirst severity value is determined from the group consisting of a userand an algorithm, wherein the algorithm is selected from the groupconsisting of the maximum likelihood estimate, the least absoluteshrinkage and selection operator, and the elasticnet, and wherein thesecond severity value is determined from the group consisting of a userand an algorithm, wherein the algorithm is selected from the groupconsisting of the maximum likelihood estimate, the least absoluteshrinkage and selection operator, and the elasticnet.
 6. The method ofclaim 1, further comprising: receiving, by one or more computerprocessors, additional environmental data associated with the firstcomputer; receiving, by one or more computer processors, additionalsocial media data associated with the first computer; determining, byone or more computer processors, a third severity value based on theadditional environmental data; determining, by one or more computerprocessors, a fourth severity value based on the additional social mediadata; determining, by one or more computer processors, a second weightedseverity score, wherein the second weighted severity score is acombination of the third severity value and the fourth severity value;determining, by one or more computers, one or more additional actions,wherein each of the one or more additional actions is selected from thegroup consisting of a recovery point objective action and a recoverytime objective action, and wherein each action of the one or moreadditional actions has a threshold; determining, by one or more computerprocessors, whether the determined second weighted severity score isgreater than or equal to any threshold associated with any actions ofthe one or more additional actions; and responsive to determining thatthe determined second weighted severity score is greater than or equalto one or more thresholds, implementing, by one or more computerprocessors, the one or more additional actions associated with the oneor more thresholds.
 7. The method of claim 1, wherein the step ofdetermining, by one or more computer processors, a second severity valuebased on the social media data associated with the first computer,comprises: studying, by one or more computer processors, the socialmedia data associated with the first computer, wherein a method of studyis selected from the group consisting of natural language processing,predictive analytics, cognitive analysis, object recognition, and videoanalytics; and determining, by one or more computer processors, a secondseverity value based on the studied social media data.
 8. A computerprogram product for providing predictive disaster recovery of cloudservices, the computer program product comprising: one or more computerreadable storage media; and program instructions stored on the one ormore computer readable storage media, the program instructionscomprising: program instructions to receive environmental dataassociated with a first computer; program instructions to receive socialmedia data associated with the first computer; program instructions todetermine a first severity value based on the environmental data;program instructions to determine a second severity value based on thesocial media data; program instructions to determine first weightedseverity score, wherein the first weighted severity score is acombination of the first severity value and the second severity value;program instructions to determine one or more actions, wherein eachaction of the one or more actions is selected from the group consistingof a recovery point objective action and a recovery time objectiveaction, and wherein each action of the one or more actions has athreshold; program instructions to determine whether the determinedfirst weighted severity score is equal to or greater than any thresholdassociated with any actions of the one or more actions; and responsiveto determining that the determined first weighted severity score isequal to or greater than one or more thresholds, program instructions toimplement, the one or more actions associated with the one or morethresholds.
 9. The computer program product of claim 8, wherein thecombination of the first severity value and the second severity value isselected from the group consisting of adding the first severity valueand the second severity value together, averaging the first severityvalue over a first periodic time basis, averaging the second severityvalue over a second periodic time basis, and adding the average firstseverity value and the average second severity value together, weightingthe first severity value, weighting the second severity value, andadding the weighted first severity value and the weighted secondseverity value together, and multiplying the first severity value by thesecond severity value.
 10. The computer program product of claim 8,wherein the environmental data is selected from the group consisting ofa news service, a weather service, and a weather sensor.
 11. Thecomputer program product of claim 8, wherein the social media dataincludes data is selected from the group consisting of a short messageservice text, a multimedia messaging service text, a content from a newsservice, a content from a social networking website, and a content froma photo/video sharing website.
 12. The computer program product of claim8, wherein the first severity value is determined from the groupconsisting of a user and an algorithm, wherein the algorithm is selectedfrom the group consisting of the maximum likelihood estimate, the leastabsolute shrinkage and selection operator, and the elasticnet, andwherein the second severity value is determined from the groupconsisting of a user and an algorithm, wherein the algorithm is selectedfrom the group consisting of the maximum likelihood estimate, the leastabsolute shrinkage and selection operator, and the elasticnet.
 13. Thecomputer program product of claim 8, further comprising programinstructions, stored on the one or more computer readable storage media,to: receive additional environmental data associated with the firstcomputer; receive additional social media data associated with the firstcomputer; determine a third severity value based on the additionalenvironmental data; determine a fourth severity value based on theadditional social media data; determine a second weighted severityscore, wherein the second weighted severity score is a combination ofthe third severity value and the fourth severity value; determine one ormore additional actions, wherein each of the one or more additionalactions is selected from the group consisting of a recovery pointobjective action and a recovery time objective action, and wherein eachaction of the one or more additional actions has a threshold; determinewhether the determined second weighted severity score is greater than orequal to any threshold associated with any actions of the one or moreadditional actions; and responsive to determining that the determinedsecond weighted severity score is greater than or equal to one or morethresholds, implement the one or more additional actions associated withthe one or more thresholds.
 14. The computer program product of claim 8,wherein the program instructions to determine a second severity valuebased on the social media data associated with the first computer,comprises: program instructions to study the social media dataassociated with the first computer, wherein a method of study isselected from the group consisting of natural language processing,predictive analytics, cognitive analysis, object recognition, and videoanalytics; and program instructions to determine a second severity valuebased on the studied social media data.
 15. A computer system forproviding predictive disaster recovery of cloud services, the computersystem comprising: one or more computer processors; one or more computerreadable storage media; and program instructions stored on the one ormore computer readable storage media for execution by at least one ofthe one or more computer processors, the program instructionscomprising: program instructions to receive environmental dataassociated with a first computer; program instructions to receive socialmedia data associated with the first computer; program instructions todetermine a first severity value based on the environmental data;program instructions to determine a second severity value based on thesocial media data; program instructions to determine first weightedseverity score, wherein the first weighted severity score is acombination of the first severity value and the second severity value;program instructions to determine one or more actions, wherein eachaction of the one or more actions is selected from the group consistingof a recovery point objective action and a recovery time objectiveaction, and wherein each action of the one or more actions has athreshold; program instructions to determine whether the determinedfirst weighted severity score is equal to or greater than any thresholdassociated with any actions of the one or more actions; and responsiveto determining that the determined first weighted severity score isequal to or greater than one or more thresholds, program instructions toimplement, the one or more actions associated with the one or morethresholds.
 16. The computer system of claim 15, wherein the combinationof the first severity value and the second severity value is selectedfrom the group consisting of adding the first severity value and thesecond severity value together, averaging the first severity value overa first periodic time basis, averaging the second severity value over asecond periodic time basis, and adding the average first severity valueand the average second severity value together, weighting the firstseverity value, weighting the second severity value, and adding theweighted first severity value and the weighted second severity valuetogether, and multiplying the first severity value by the secondseverity value.
 17. The computer system of claim 15, wherein theenvironmental data is selected from the group consisting of a newsservice, a weather service, and a weather sensor.
 18. The computersystem of claim 15, wherein the social media data includes data isselected from the group consisting of a short message service text, amultimedia messaging service text, a content from a news service, acontent from a social networking website, and a content from aphoto/video sharing website.
 19. The computer system of claim 15,wherein the first severity value is determined from the group consistingof a user and an algorithm, wherein the algorithm is selected from thegroup consisting of the maximum likelihood estimate, the least absoluteshrinkage and selection operator, and the elasticnet, and wherein thesecond severity value is determined from the group consisting of a userand an algorithm, wherein the algorithm is selected from the groupconsisting of the maximum likelihood estimate, the least absoluteshrinkage and selection operator, and the elasticnet.
 20. The computersystem of claim 15, further comprising program instructions, stored onthe one or more computer readable storage media, for execution by atleast one of the one or more computer processors, to: receive additionalenvironmental data associated with the first computer; receiveadditional social media data associated with the first computer;determine a third severity value based on the additional environmentaldata; determine a fourth severity value based on the additional socialmedia data; determine a second weighted severity score, wherein thesecond weighted severity score is a combination of the third severityvalue and the fourth severity value; determine one or more additionalactions, wherein each of the one or more additional actions is selectedfrom the group consisting of a recovery point objective action and arecovery time objective action, and wherein each action of the one ormore additional actions has a threshold; determine whether thedetermined second weighted severity score is greater than or equal toany threshold associated with any actions of the one or more additionalactions; and responsive to determining that the determined secondweighted severity score is greater than or equal to one or morethresholds, implement the one or more additional actions associated withthe one or more thresholds.